Description
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 3
- DSA-187 apache - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-195 apache-perl - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-188 apache-ssl - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-188 vendor-advisory
- 5990 vdb-entry
- DSA-187 vendor-advisory
- 5981 vdb-entry
- DSA-195 vendor-advisory
- apache-htdigest-tmpfile-race(10413) vdb-entry
- 20021016 Apache 1.3.26 mailing-list
- apache-htpasswd-tmpfile-race(10412) vdb-entry